52 lines
1.9 KiB
Diff
52 lines
1.9 KiB
Diff
|
From e6cbf971242e424264711f9ffad57eee7f6d6f67 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Mark Wielaard <mark@klomp.org>
|
||
|
|
Date: Tue, 21 Mar 2017 16:46:37 +0100
|
||
|
|
Subject: [PATCH] debugedit: Fix off-by-one adding DW_FORM_string replacement
|
||
|
|
slashes.
|
||
|
|
|
||
|
|
We would put one too many slashes in between the new dest_dir and file name
|
||
|
|
part of the replacement of a DW_FORM_string in the .debug_info. If there
|
||
|
|
was file part then we would overwrite the first character of the name. If
|
||
|
|
there was no file part at all then this would overwrite the zero terminator
|
||
|
|
and cause a crash reading the rest of the data.
|
||
|
|
|
||
|
|
A crash did happen while building the docker package on fedora s390x.
|
||
|
|
https://bugzilla.redhat.com/show_bug.cgi?id=1434347
|
||
|
|
|
||
|
|
The reason neither issue would normally trigger is because if we do detect
|
||
|
|
that the dest_dir is larger than the base_dir we refuse to replace anything.
|
||
|
|
|
||
|
|
Signed-off-by: Mark Wielaard <mark@klomp.org>
|
||
|
|
---
|
||
|
|
tools/debugedit.c | 12 ++++++++----
|
||
|
|
1 file changed, 8 insertions(+), 4 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/tools/debugedit.c b/tools/debugedit.c
|
||
|
|
index 0f37316..b618dce 100644
|
||
|
|
--- a/tools/debugedit.c
|
||
|
|
+++ b/tools/debugedit.c
|
||
|
|
@@ -1507,12 +1507,16 @@ edit_attributes (DSO *dso, unsigned char *ptr, struct abbrev_tag *t, int phase)
|
||
|
|
comp_dir, base_dir, dest_dir);
|
||
|
|
else
|
||
|
|
{
|
||
|
|
- /* Add one or more slashes in between to
|
||
|
|
- fill up all space (replacement must be
|
||
|
|
- of the same length). */
|
||
|
|
+ /* Add zero (if no file part), one or more
|
||
|
|
+ slashes in between the new dest_dir and the
|
||
|
|
+ file name to fill up all space (replacement
|
||
|
|
+ DW_FORM_string must be of the same length).
|
||
|
|
+ We don't need to copy the old file name (if
|
||
|
|
+ any) or the zero terminator, because those
|
||
|
|
+ are already at the end of the string. */
|
||
|
|
memcpy (ptr, dest_dir, dest_len);
|
||
|
|
memset (ptr + dest_len, '/',
|
||
|
|
- orig_len - new_len + 1);
|
||
|
|
+ orig_len - new_len);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
--
|
||
|
|
1.8.3.1
|
||
|
|
|